Question

A detection engineer is writing a YARA-L single-event rule to flag PowerShell downloads via LOLBins. Leadership requires that the alert severity dynamically reflect risk: events involving a system account should be tagged 'HIGH', all others 'LOW'. The engineer wants this severity to appear as a queryable field on each detection so downstream SOAR playbooks can route on it. Which approach correctly implements this in YARA-L 2.0?

Accepted Answer

Define an outcome variable (e.g., $risk_severity) using an if()/conditional expression in the outcome section, then reference it in the match/condition logic and it is emitted as a detection field.

Answer

Set two separate metadata.severity values inside the meta section, one for each account condition, and SecOps picks the matching one at detection time.

Answer

Hardcode metadata.severity = "HIGH" in the meta section and let the SOAR playbook recompute the correct value after ingestion.

Answer

Use a placeholder variable in the events section with a regex that rewrites the account name into a severity string, then map it to metadata.severity.